fbc-release.yaml

---
apiVersion: tekton.dev/v1
kind: Pipeline
metadata:
  name: fbc-release
  annotations:
    tekton.dev/pipelines.minVersion: "0.12.1"
    tekton.dev/tags: release
spec:
  description: |-
    Tekton release pipeline to interact with FBC Pipeline
  params:
    - name: release
      type: string
      description:
        The namespaced name (namespace/name) of the Release custom resource initiating this pipeline execution
    - name: releasePlan
      type: string
      description: The namespaced name (namespace/name) of the releasePlan
    - name: releasePlanAdmission
      type: string
      description: The namespaced name (namespace/name) of the releasePlanAdmission
    - name: releaseServiceConfig
      type: string
      description: The namespaced name (namespace/name) of the releaseServiceConfig
    - name: snapshot
      type: string
      description: The namespaced name (namespace/name) of the snapshot
    - name: enterpriseContractPolicy
      type: string
      description: JSON representation of the EnterpriseContractPolicy
    - name: enterpriseContractExtraRuleData
      type: string
      description: |
        Extra rule data to be merged into the policy specified in params.enterpriseContractPolicy. Use syntax
        "key1=value1,key2=value2..."
      default: "pipeline_intention=release"
    - name: verify_ec_task_bundle
      type: string
      description: The location of the bundle containing the verify-enterprise-contract task
    - name: verify_ec_task_git_revision
      type: string
      description: Previously used for the Conforma task git resolver, now deprecated and ignored
      default: ignored
    - name: taskGitUrl
      type: string
      description: The url to the git repo where the release-service-catalog tasks to be used are stored
      default: https://github.com/konflux-ci/release-service-catalog.git
    - name: taskGitRevision
      type: string
      description: The revision in the taskGitUrl repo to be used
    - name: ociStorage
      type: string
      description: The OCI repository where the Trusted Artifacts are stored
      default: "quay.io/konflux-ci/release-service-trusted-artifacts"
    - name: orasOptions
      description: oras options to pass to Trusted Artifacts calls
      type: string
      default: ""
    - name: trustedArtifactsDebug
      description: Flag to enable debug logging in trusted artifacts. Set to a non-empty string to enable
      type: string
      default: ""
    - name: dataDir
      description: The location where data will be stored
      type: string
      # to avoid tar extraction errors, we need to specify a subdirectory
      # inside the volume.
      default: "/var/workdir/release"
  tasks:
    - name: verify-access-to-resources
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/verify-access-to-resources/verify-access-to-resources.yaml
      params:
        - name: release
          value: $(params.release)
        - name: releasePlan
          value: $(params.releasePlan)
        - name: releasePlanAdmission
          value: $(params.releasePlanAdmission)
        - name: releaseServiceConfig
          value: $(params.releaseServiceConfig)
        - name: snapshot
          value: $(params.snapshot)
        - name: requireInternalServices
          value: "true"
    - name: collect-data
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/collect-data/collect-data.yaml
      params:
        - name: release
          value: $(params.release)
        - name: releasePlan
          value: $(params.releasePlan)
        - name: releasePlanAdmission
          value: $(params.releasePlanAdmission)
        - name: releaseServiceConfig
          value: $(params.releaseServiceConfig)
        - name: snapshot
          value: $(params.snapshot)
        - name: subdirectory
          value: $(context.pipelineRun.uid)
        - name: ociStorage
          value: $(params.ociStorage)
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
      runAfter:
        - verify-access-to-resources
    - name: collect-task-params
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/collect-task-params/collect-task-params.yaml
      params:
        - name: dataDir
          value: "$(params.dataDir)"
        - name: dataPath
          value: "$(tasks.collect-data.results.data)"
        - name: keysToExtract
          value: |
            [
              {"resultIndex": 0, "key": ".conforma.workerCount", "default": "4"},
              {"resultIndex": 1, "key": ".pyxis.secret"},
              {"resultIndex": 2, "key": ".pyxis.server", "default": "production"},
              {"resultIndex": 3, "key": ".sign.cosignSecretName", "default": ""}
            ]
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
        - name: ociStorage
          value: $(params.ociStorage)
        - name: sourceDataArtifact
          value: "$(tasks.collect-data.results.sourceDataArtifact)"
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
      runAfter:
        - collect-data
    - name: check-data-keys
      params:
        - name: dataPath
          value: "$(tasks.collect-data.results.data)"
        - name: systems
          value: |
            [
              {"systemName": "fbc", "dynamic": false},
              {"systemName": "sign", "dynamic": false}
            ]
        - name: ociStorage
          value: $(params.ociStorage)
        - name: sourceDataArtifact
          value: "$(tasks.collect-data.results.sourceDataArtifact)"
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
      taskRef:
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/check-data-keys/check-data-keys.yaml
        resolver: git
      runAfter:
        - collect-data
    - name: filter-published-fbc-images
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/filter-published-fbc-images/filter-published-fbc-images.yaml
      params:
        - name: snapshotPath
          value: "$(tasks.collect-data.results.snapshotSpec)"
        - name: dataPath
          value: "$(tasks.collect-data.results.data)"
        - name: pyxisSecret
          value: $(tasks.collect-task-params.results.extractedValues[1])
        - name: ociStorage
          value: $(params.ociStorage)
        - name: sourceDataArtifact
          value: "$(tasks.collect-data.results.sourceDataArtifact)"
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
      runAfter:
        - collect-data
        - collect-task-params
    - name: verify-conforma
      timeout: "4h00m0s"
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: https://github.com/conforma/tekton-catalog
          - name: revision
            value: "f20c7a8c15a71c9462b11e5a28f8907a29c7075a"
          - name: pathInRepo
            value: "tasks/verify-conforma-konflux-ta/0.1/verify-conforma-konflux-ta.yaml"
      params:
        - name: SNAPSHOT_FILENAME
          value: "$(tasks.filter-published-fbc-images.results.filteredSnapshotPath)"
        - name: SSL_CERT_DIR
          value: /var/run/secrets/kubernetes.io/serviceaccount
        - name: POLICY_CONFIGURATION
          value: $(params.enterpriseContractPolicy)
        - name: STRICT
          # only set to false for development
          value: "true"
        - name: IGNORE_REKOR
          value: "true"
        - name: EXTRA_RULE_DATA
          value: $(params.enterpriseContractExtraRuleData)
        - name: WORKERS
          value: "$(tasks.collect-task-params.results.extractedValues[0])"
        - name: SOURCE_DATA_ARTIFACT
          value: "$(tasks.filter-published-fbc-images.results.sourceDataArtifact)"
        - name: TRUSTED_ARTIFACTS_DEBUG
          value: "$(params.trustedArtifactsDebug)"
      runAfter:
        - filter-published-fbc-images
        - collect-task-params
    - name: prepare-fbc-parameters
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/prepare-fbc-parameters/prepare-fbc-parameters.yaml
      params:
        - name: dataPath
          value: "$(tasks.collect-data.results.data)"
        - name: snapshotPath
          value: "$(tasks.filter-published-fbc-images.results.filteredSnapshotPath)"
        - name: sourceDataArtifact
          value: "$(tasks.filter-published-fbc-images.results.sourceDataArtifact)"
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
        - name: pyxisSecret
          value: $(tasks.collect-task-params.results.extractedValues[1])
        - name: pyxisServer
          value: $(tasks.collect-task-params.results.extractedValues[2])
        - name: pipelineRunUid
          value: $(context.pipelineRun.uid)
      runAfter:
        - verify-conforma
        - collect-task-params
        - filter-published-fbc-images
    - name: prepare-fbc-snapshot
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/prepare-fbc-snapshot/prepare-fbc-snapshot.yaml
      params:
        - name: dataPath
          value: "$(tasks.collect-data.results.data)"
        - name: snapshotPath
          value: "$(tasks.filter-published-fbc-images.results.filteredSnapshotPath)"
        - name: ociStorage
          value: $(params.ociStorage)
        - name: sourceDataArtifact
          value: "$(tasks.filter-published-fbc-images.results.sourceDataArtifact)"
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
      runAfter:
        - filter-published-fbc-images
        - verify-conforma
    - name: add-fbc-contribution-to-index-image
      retries: 3
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/add-fbc-contribution/add-fbc-contribution.yaml
      params:
        - name: dataPath
          value: "$(tasks.collect-data.results.data)"
        - name: snapshotPath
          value: "$(tasks.filter-published-fbc-images.results.filteredSnapshotPath)"
        - name: pipelineRunUid
          value: $(context.pipelineRun.uid)
        - name: resultsDirPath
          value: "$(tasks.collect-data.results.resultsDir)"
        - name: ociStorage
          value: $(params.ociStorage)
        - name: sourceDataArtifact
          value: "$(tasks.prepare-fbc-snapshot.results.sourceDataArtifact)"
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: $(params.taskGitUrl)
        - name: taskGitRevision
          value: $(params.taskGitRevision)
        - name: mustPublishIndexImage
          value: "$(tasks.prepare-fbc-parameters.results.mustPublishIndexImage)"
        - name: mustOverwriteFromIndexImage
          value: "$(tasks.prepare-fbc-parameters.results.mustOverwriteFromIndexImage)"
        - name: iibServiceAccountSecret
          value: "$(tasks.prepare-fbc-parameters.results.iibServiceAccountSecret)"
      runAfter:
        - prepare-fbc-parameters
        - prepare-fbc-snapshot
        - verify-conforma
        - collect-data
    - name: extract-requester-from-release
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: hub/kubernetes-actions/kubernetes-actions.yaml
      params:
        - name: image
          value: "quay.io/hacbs-release/cloud-builders-kubectl\
            @sha256:8ab94be8b2b4f3d117f02d868b39540fddd225447abf4014f7ba4765cb39f753"
        - name: script
          value: |
            set -x

            NAMESPACE=$(echo $(params.release) | cut -d '/' -f 1)
            NAME=$(echo $(params.release) | cut -d '/' -f 2)

            AUTHOR=$(kubectl get release ${NAME} -n ${NAMESPACE} \
            -o=jsonpath='{.status.attribution.author}' | tee $(results.output-result.path))

            if [[ ${AUTHOR} == "" ]] ; then exit 1 ; fi
      runAfter:
        - verify-access-to-resources
    - name: sign-index-image
      retries: 3
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/sign-index-image/sign-index-image.yaml
      params:
        - name: dataPath
          value: "$(tasks.collect-data.results.data)"
        - name: releasePlanAdmissionPath
          value: "$(tasks.collect-data.results.releasePlanAdmission)"
        - name: requester
          value: $(tasks.extract-requester-from-release.results.output-result)
        - name: pipelineRunUid
          value: $(context.pipelineRun.uid)
        - name: ociStorage
          value: $(params.ociStorage)
        - name: sourceDataArtifact
          value: "$(tasks.add-fbc-contribution-to-index-image.results.sourceDataArtifact)"
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: $(params.taskGitUrl)
        - name: taskGitRevision
          value: $(params.taskGitRevision)
        - name: fbcResultsPath
          value: "$(tasks.add-fbc-contribution-to-index-image.results.internalRequestResultsFile)"
        - name: pyxisServer
          value: $(tasks.collect-task-params.results.extractedValues[2])
        - name: pyxisSecret
          value: $(tasks.collect-task-params.results.extractedValues[1])
      when:
        - input: "$(tasks.prepare-fbc-parameters.results.mustSignIndexImage)"
          operator: in
          values: ["true"]
      runAfter:
        - extract-requester-from-release
        - add-fbc-contribution-to-index-image
        - collect-task-params
    - name: rh-sign-index-image-cosign
      timeout: "6h00m0s"
      retries: 3
      when:
        - input: "$(tasks.prepare-fbc-parameters.results.mustSignIndexImage)"
          operator: in
          values: ["true"]
        - input: $(tasks.collect-task-params.results.extractedValues[3])
          operator: notin
          values: [""]
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/rh-sign-image-cosign/rh-sign-image-cosign.yaml
      params:
        - name: snapshotPath
          value: "$(tasks.collect-index-images.results.indexImageSnapshot)"
        - name: secretName
          value: "$(tasks.collect-task-params.results.extractedValues[3])"
        - name: ociStorage
          value: $(params.ociStorage)
        - name: sourceDataArtifact
          value: "$(tasks.collect-index-images.results.sourceDataArtifact)"
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
      runAfter:
        - collect-index-images
        - collect-task-params
        - prepare-fbc-parameters
    - name: extract-index-image
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/extract-index-image/extract-index-image.yaml
      params:
        - name: inputDataFile
          value: $(tasks.add-fbc-contribution-to-index-image.results.requestResultsFile)
        - name: resultsDirPath
          value: "$(tasks.collect-data.results.resultsDir)"
        - name: ociStorage
          value: $(params.ociStorage)
        - name: sourceDataArtifact
          value: "$(tasks.add-fbc-contribution-to-index-image.results.sourceDataArtifact)"
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
        - name: internalRequestResultsFile
          value: $(tasks.add-fbc-contribution-to-index-image.results.internalRequestResultsFile)
      runAfter:
        - add-fbc-contribution-to-index-image
    - name: publish-index-image
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/publish-index-image/publish-index-image.yaml
      params:
        - name: dataPath
          value: "$(tasks.collect-data.results.data)"
        - name: internalRequestResultsFile
          value: $(tasks.add-fbc-contribution-to-index-image.results.internalRequestResultsFile)
        - name: buildTimestamp
          value: $(tasks.add-fbc-contribution-to-index-image.results.buildTimestamp)
        - name: retries
          value: "3"
        - name: pipelineRunUid
          value: $(context.pipelineRun.uid)
        - name: ociStorage
          value: $(params.ociStorage)
        - name: sourceDataArtifact
          value: "$(tasks.sign-index-image.results.sourceDataArtifact)"
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: $(params.taskGitUrl)
        - name: taskGitRevision
          value: $(params.taskGitRevision)
      when:
        - input: $(tasks.prepare-fbc-parameters.results.mustPublishIndexImage)
          operator: in
          values: ["true"]
      runAfter:
        - sign-index-image
        - rh-sign-index-image-cosign
    - name: collect-index-images
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/collect-index-images/collect-index-images.yaml
      params:
        - name: buildTimestamp
          value: $(tasks.add-fbc-contribution-to-index-image.results.buildTimestamp)
        - name: internalRequestResultsFile
          value: $(tasks.add-fbc-contribution-to-index-image.results.internalRequestResultsFile)
        - name: ociStorage
          value: $(params.ociStorage)
        - name: sourceDataArtifact
          value: "$(tasks.add-fbc-contribution-to-index-image.results.sourceDataArtifact)"
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
      when:
        - input: $(tasks.prepare-fbc-parameters.results.mustPublishIndexImage)
          operator: in
          values: ["true"]
      runAfter:
        - add-fbc-contribution-to-index-image
        - prepare-fbc-parameters
    - name: create-pyxis-image
      retries: 5
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/create-pyxis-image/create-pyxis-image.yaml
      params:
        - name: server
          value: $(tasks.collect-task-params.results.extractedValues[2])
        - name: pyxisSecret
          value: $(tasks.collect-task-params.results.extractedValues[1])
        - name: rhPush
          value: "true"
        - name: snapshotPath
          value: "$(tasks.collect-index-images.results.indexImageSnapshot)"
        - name: dataPath
          value: "$(tasks.collect-data.results.data)"
        - name: ociStorage
          value: $(params.ociStorage)
        - name: sourceDataArtifact
          value: "$(tasks.collect-index-images.results.sourceDataArtifact)"
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
      when:
        - input: $(tasks.prepare-fbc-parameters.results.mustPublishIndexImage)
          operator: in
          values: ["true"]
      runAfter:
        - collect-task-params
        - collect-index-images
        - publish-index-image
    - name: update-cr-status
      params:
        - name: resource
          value: $(params.release)
        - name: resultsDirPath
          value: $(tasks.collect-data.results.resultsDir)
        - name: ociStorage
          value: $(params.ociStorage)
        - name: resultArtifacts
          value:
            - "$(tasks.add-fbc-contribution-to-index-image.results.sourceDataArtifact)=$(params.dataDir)"
            - "$(tasks.extract-index-image.results.sourceDataArtifact)=$(params.dataDir)"
        - name: dataDir
          value: $(params.dataDir)
        - name: trustedArtifactsDebug
          value: "$(params.trustedArtifactsDebug)"
        - name: taskGitUrl
          value: "$(params.taskGitUrl)"
        - name: taskGitRevision
          value: "$(params.taskGitRevision)"
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/update-cr-status/update-cr-status.yaml
      runAfter:
        - extract-index-image
  finally:
    - name: cleanup-internal-requests
      taskRef:
        resolver: "git"
        params:
          - name: url
            value: $(params.taskGitUrl)
          - name: revision
            value: $(params.taskGitRevision)
          - name: pathInRepo
            value: tasks/managed/cleanup-internal-requests/cleanup-internal-requests.yaml
      params:
        - name: pipelineRunUid
          value: $(context.pipelineRun.uid)